sazonovanton/radm repository overview

⁠RADM — an admin panel for devices

Monitoring, terminal, files and port forwarding for devices that sit behind NAT, on mobile internet, with no public IP and no VPN.

The device itself opens one outbound WSS connection to your server — to an ISP, to CGNAT and to a corporate firewall that is ordinary HTTPS, so nothing has to be forwarded on the router. The panel's reverse access rides that same connection: an SSH terminal, files over SFTP and HTTP tunnels to services on the board.

• Terminal — a real SSH client over a tunnelled stream to the device's 127.0.0.1:22.
• Files — SFTP on that same connection, no home-grown file protocol.
• Tunnels — a device port published as https://<device>-<port>.tunnel.example.com, private by default, or a public random link you can hand out and rotate.
• Metrics — CPU per core, memory, disks, network, temperature, Raspberry Pi throttling flags, Rockchip NPU / Mali / Jetson / AMD / NVIDIA utilisation. Downsampled and gap-free: the agent buffers while the link is down.

Source, documentation and the compose files: https://github.com/sazonovanton/radm⁠

⁠Quick start

The panel expects a reverse proxy with TLS in front of it. The repository ships a compose file that brings up Traefik alongside it, obtains a wildcard certificate over DNS-01 and declares the routes as labels:

git clone https://github.com/sazonovanton/radm && cd radm
cp deploy/.env.example deploy/.env          # RADM_SECRET_KEY, your domains
cp deploy/.env.dns.example deploy/.env.dns  # DNS provider token for DNS-01
docker compose -f deploy/docker-compose.yml up -d

Already running a proxy of your own? Comment out COMPOSE_PROFILES in deploy/.env and the same file brings up the panel alone, on your proxy's network.

To just look at the UI, without TLS and without devices:

docker run --rm -p 8000:8000 \
  -e RADM_SECRET_KEY="$(openssl rand -base64 36)" \
  -e RADM_ADMIN_USER=admin -e RADM_ADMIN_PASSWORD=changeme \
  -e RADM_TRUSTED_PROXIES=0 \
  -v radm-data:/data sazonovanton/radm:v1.0

Then open http://localhost:8000⁠. Do not run it this way in production: over plain HTTP the session cookie loses its Secure flag and travels in the clear.

⁠Configuration

State — devices, tokens, encrypted SSH keys, metrics, tunnels, the audit log — is a single SQLite file in /data; mount a volume there. The panel listens on 8000 and runs with one uvicorn worker by design: connections live in the memory of that process.